[Patrick-Erichsen]

What Problem This Solves

Bash comments, closing quotes and comparison operands can cause incomplete static inspection of otherwise parsed shell files.

User Impact

Three untouched SpaceDuck 0.10.4 shell files now complete static tool-misuse inspection. The original file containing real eval remains partial. This does not establish whole-publication recovery.

Why This Change Was Made

A bounded canonical Bash AST supplies source roles while retaining existing lexical command starts and raw findings. Unknown command construction, arithmetic/indirect expansions and parameter assignments remain conservative. Build shfmt v3.14.1 with Go 1.27.3 for each runtime architecture; missing or bounded-out parsing retains lexical fallback.

original source → bounded Bash AST → proven source roles + existing lexical candidates
                                  → unknown secondary evaluation stays incomplete

Evidence

Original SpaceDuck file	Before	After
scripts/doctor.sh	partial	completed
scripts/reply_with_claude.sh	partial	completed
scripts/setup_byob_bridge.sh	partial	completed
scripts/openclaw_brain.sh	partial	partial

Original file hashes and every raw TM finding match. These paired runs use the real static-runner ledger path, with unchanged retained source and no LLM calls. No production retry was performed.

485 source controls and 328 installed Linux adapter controls pass, including all six parameter-assignment operator/spacing controls, required parser version and actual subprocess timeout/reaping. Fresh upstream-plus-patch reconstruction matches all 134 source/dependency files. Go tests and vet pass. The merge of current CSV main preserves both reviewed Bash patch blocks byte-for-byte; the integrated adapter suite and original replay were rerun after conflict resolution. Independent P0–P3 source review is complete after repairing secondary-evaluation findings; runtime integration follow-up review is complete and scoped-clean after repairing a naked-declaration assignment exclusion.

Merge Danger

Door: two-way. Revert the runtime source pin to roll back; no stored-data changes.

Blast Radius: scanning. This changes static inspection accounting for shell source. Production host workers also need the companion installer and source-pin adoption before activation.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.